Your description doesn't match the example. Do you actuallty want all your syslog messages - regardless of level - in the database, or do you only want the warning messages?
–
Jenny DApr 14 '14 at 13:21

Yep, you right - I just copy/paste it from my config. But - I interesting to AND for all severity. Will edit example, thanks.
–
setevoyApr 14 '14 at 13:32

2 Answers
2

I don't know if it would be considered more correct, since I think it is an rsyslog specific feature (and it might be considered "more correct" to do things in a syslog compatible way whenever possible...or it might not) but there is the ampersand:

It's documented here, if you search the page for "ampersand". I believe "legacy description" there refers to not to "syslog compatible" behaviour but to the legacy behavior of rsyslog, which now implements something called RainerScript for writing rules. As to whether that's really easier or more correct in this case I can't say.

Edit: this was valid with the example given in the question to start with. It's since been edited, and the answer by TAFKA 'goldilocks' is the correct one.

You're doing it right. When you want to select a different set of log entries, you need to specify it on a separate line, just as you do. The fact that the two selections happen to have the same facility is irrelevant.

If you wanted to do two things to the same set of log entries, you could instead use an ampersand (&) on the second line. E.g. if you wanted to store all syslog messages in both a file and a database: